Masterclass: Threat Hunting with AI

This Live Virtual Class consists of 13 Modules in terms of Threat Hunting with AI Support. They include essential theory combined with individual practice during the exercises as well as loads of hands-on tools and real-case scenarios.

Module 1: Modern Attack Techniques and Tracing Them

1. Discussion: Top attack techniques
2. Advanced Persistent Threats
3. Initial access vectors
4. Phishing – rev shell mail phishing bob
5. Valid Credentials – password spray exc.
6. Spoofing – DSN Twist
7. Vulnerable components (drive by download)
8. Weak defaults
9. Other vectors Escalation through Windows Services

Module 2: Local Privilege Escalation Techniques and Tracing Them

1. Unquoted service path
2. Image and DLL manipulation
3. Schedule Tasks
4. Access Token Manipulation
5. SeImpersonate
6. SeTcb
7. Create User Token
8. Process Injection
9. DLL Injection and Reflective DLL Injection
10. CreateRemoteThread
11. Memory Injection
12. Other techniques

Module 3: Case Study – Investigating In-Place Attacks

Module 4: Windows Authentication Architecture & Cryptography

1. Windows Logon
2. Windows Logon Types
3. LSASS Architecture
4. NTLM
5. Kerberos
6. SAM Database
7. NTDS.dit
8. LSA Secrets & gMSA accounts
9. Secrets, credentials and Logon Data
10. PKI Misconfigurations
11. SSP Providers
12. Data Protection API

Module 5: Case Study – Investigating Identity Theft

Module 6: Attacks on Identity Infrastructure and Tracing Them

1. Pass-the-Hash, OverPTH attacks
2. Pass the ticket
3. Golden and silver ticket
4. Pass the PRT
5. Shadow Credentials / NGC
6. NBNS/LLMNR spoofing, NTLM Relay, Kerberoasting
7. DCSync and DCShadow
8. AdminSDholder
9. Other Modern identity attack techniques

Module 7: Microsoft 365 Defender for Endpoint – EDR

1. Intro 101 to Microsoft Defender ecosystem
2. EDR deployment strategies
3. EDR installation and configuration
4. Fine tuning and hardening of EDR configuration
5. Managing and Maintaining Security Posture
6. Troubleshooting Common Issues
7. Automation with ServiceNow and 3rd party

Module 8: Security Operations with Microsoft EDR (Defender for Endpoints) – Advanced Threat Hunting with Defender

1. EDR integration with Microsoft Azure Sentinel
2. Security Operations best practices with Microsoft EDR and Sentinel
3. How to manage Incidents inside EDR and Sentinel
4. Kusto language 101 – basic and advanced queries
5. Advanced Hunting
6. Hacker ways to hide malware and bypass EDR

Module 9: Microsoft Security Copilot

1. Introduction to Microsoft Security Copilot
2. Developing and Using Promptbooks
3. Create Effective Promptbooks for Security Analysis
4. Plugins Management
5. Data Security and Privacy
6. Responsible AI at Microsoft

Module 10: Case Study – Detecting a Complex Threat with Sentinel and Microsoft Copilot for Security

Module 11: Network Forensics and Monitoring

1. Types and approaches to network monitoring
2. Network evidence acquisition
3. Network protocols and Logs
4. Gathering data from network security appliances
5. Detecting intrusion patterns and attack indicators
6. Data correlation
7. Hunting malware in network traffic

Module 12: Memory Dumping and Analysis

1. Introduction to memory dumping and analysis
2. Creating memory dump – Belkasoft RAM Capturer and DumpIt
3. Creating memory dump
4. Utilizing Volatility to analyse Windows memory image
5. Analysing Stuxnet memory dump with Volatility
6. Automatic memory analysis with Volatile

Module 13: Disk Dumping & Analysis

1. Introduction to storage acquisition and analysis
2. Drive Acquisition
3. Autopsy
4. Building timelines
5. File System Analysis Techniques
6. Encryption and Decryption of Drives
7. Deep-Dive into Automatic Destinations
8. Extracting Information About Network Activity